Host audit policy

1actions

2reasons

1sources

Livestatus

The combined audit settings observed on the host.

Identified by: sparklogs.config_change.target, which carries a fixed name where a host carries only one.

Action	Basis	Reported by	What that reason says
updated	observed	audit_policy_changed on Audit policy	The host's audit policy changed: more Windows Security events are audited, or the audit framework changed.
updated	observed	audit_policy_coverage_reduced on Audit policy	The host's audit policy changed and now records fewer Windows Security events than before.